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Good  day  ladies  and  gentlemen,  my  name  is  Major  Loria,  and  with  me  today  is 

Mr.  Beck. 

We  were  the  Project  Officer  and  Project  Engineer  for  the  flight  test  & 
simulation  portions  of  this  test  project. 

Our  goals  today  are  to  present  the  lessons  learned  from  a  safety  aspect,  in 
regards  to  the  Hornets  Flight  Control  System,  the  continuing  improvement  of  that  system,  and 
the  simulation  and  flight  test  of  new  flight  controls  laws. 


TOPICS  OF  DISCUSSION 

♦  The  F/A-18  Hornet 

♦  Flight  Control  System  Design  &  Operation 

♦  Operational  &  Mishaps  Lessons  Learned 

♦  Operational  Flight  Program  Testing 

—  Lab,  Simulator  &  Ground  Testing 

-  Flight  Testing 

♦  Results  &  Conclusions 

♦  Lessons  Learned 
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Our  briefing  today  will  cover  the: 

F/A-18  Aircraft 


An  overview  of  the  Hornet’s  Flight  Control  System 


A  brief  synopsis  of  selected  flight  controls  system  related 
mishaps. 


Our  testing  of  the  software,  or  “Operational  Flight  Program 
which  in  a  highly  augmented,  fly-by-wire 
aircraft  constitutes  a  new  flight  control  system. 


Results  and  Conclusions. 


And  a  brief  overview  of  lessons  learned. 


THE  F/A-18  HORNET _ 

♦  Flight  Controls  System 

-  Four  Channel,  Fly-by-Wire  Flight  Control 
System 

-  Two  Hydraulic  systems;  four  total  circuits 

-  Control  Surface  actuators  feature  multiple 
levels  of  electrical  &  hydraulic  redundancy 

♦  Care-free  handling  qualities: 

-  Aircrew  can  concentrate  on  employing  their 
weapons  &  defeating  the  enemy 
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The  F/A-18  Hornet  enjoys  care-free  handling  qualities  throughout  the  flight 

envelope. 

The  system  has  been  designed  with  reliability,  &  maintainability,  ^  primary 
goals  The  life  blood  of  the  flight  controls  is  the  aircraft’  s  two  hydraulic  systems,  which  are 
independent  and  driven  mechanically  by  the  aircraft  engines.  Furthermore,  the  two  systems 
are  further  divided  into  two  hydraulic  circuits  for  further  redundancy. 

The  ailerons,  mdders,  and  leading  edge  flaps  feature  dual  redundancy 
electronically,  with  simplex  hydraulic,  but  with  a  hydraulic  switching  valve  for  a  backup 
hydraulic  source.  The  trailing  edge  flaps  and  stabilators  are  quad  redundant  electrically  (dual 
fail  op).  The  trailing  edge  flaps  have  dual  redundant  hydraulics,  and  the  stab  goes  an  extra 
measure,  they  have  dual  redundant  hydraulics  with  a  switching  valve  to  back-up  one 
hydraulic  source  (e.g.  dual  hyd  redundancy  w/  a  third  hyd  source  via  a  switching  valve). 

The  bottom  line  is  that  Hornet  Aircrew  enjoy  unparalleled  flying  qualities 
which  enables  them  to  devote  their  concentration  on  employing  the  aircraft  tactically. 


HORNET  FLIGHT  CONTROLS 

♦  Reliability,  Maintainability  &  Dependability 

-  Faired-Flutter  Damped  Mode: 

»  Ailerons 
»  Rudders 

-  Stabilators 

»  Mechanical  Back-up  Mode 
»  Bypass  Mode  &  Streamline: 

-  Lock-  in-Position: 

»  Leading  Edge  Flaps  (Lock  at  failed  position) 
04/16/96  Trailing  Edge  Flaps  (Moves  to  zero  deg  and  locks) 


The  flight  controls  system  has  been  designed  for  reliability,  maintainability 
and  dependability.  The  aircraft  enjoys  mission  capable  rates  unmatched  by  any  other  fixe 
wing  asset  in  the  US  inventory. 


The  aircraft  was  designed  the  Strike  Fighter  mission  with  resistance  to  battle 
damage,  and  maximum  get  home  capability  also  key  design  drivers. 


The  fail  to  faired-flutter  damped  mode  was  designed  into  the  ailerons,  and 
rudders.  The  stabilators  having  quad  electronic,  triplex  hydraulic  with  Mechanical  Mode,  and 
back-up  are  extremely  dependable  and  reliable.  These  flight  control  surface  reversionary 
modes  have  however,  never  been  flight  tested. 


The  leading  edge  flaps,  by  virtue  of  their  location  and  range  of  motion  have 
integral  brakes  on  the  leading  edge  flaps  transmission  which  will  lock  a  leading  edge  flap  in 
position  should  it  fail  to  follow  normal  scheduling. 


Trailing  edge  flaps  having  dual  hydraulic  and  quad  electrical  redundancy  are 
again  quite  reliabie.  However,  in  the  event  they,  or  one  should  fail,  the  control  surface  wr 
Lve  to  zero  degrees  (by  hydraulic  power  or  airloads)  and  lock  in  place  to  rmnrmtze  a  spirt 

flap  condition. 


Operational  Lessons  Learned 

♦  Good,  well  thought  out  system,  with  respect 
to  the  expected  threat  to  aircraft  &  aircrew. 

♦  Few  battle  damaged  flight  controls  to  date 

♦  RF AT.  THREAT  has  so  far  turned  out  to  be 
failures  encountered  during  training  and  the 
takeoff  and  landing  phases. 
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Basically  we  have  a  very  good,  dependable  system  that  has  served,  and 
continues  to  serve  remarkably  well  for  the  planned  threats. 


For  the  purposes  of  this  briefing,  and  to  cover  the  high  points  of  the  flight 
controls  software  upgrades,  we  will  review  a  few  selected  items,  or  areas. 

Certain  recent  mishaps  have  demonstrated  the  significant  threat  to  aircrew  and 
aircraft  posed  by  complete  loss  of  a  single  Angle  of  Attack  probe  input  to  the  flight  controls 
system  and  certain  control  surface  actuator  failures. 

The  tragic  fact  about  the  Angle  of  Attack  and  actuator  failures  is  that  when 
they  occur  close  to  the  ground,  as  in  the  takeoff  and  landing  phases;  there  is  precious  little 
time  to  react  to  the  resulting  transients  that  may  rapidly  place  the  pilot  out  of  the  ejection 

envelope. 


Hornet  Flight  Control  System 

♦  Longitudinal  Outer  Loop  Feedback: 
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Here  is  a  simplified  diagram  of  the  Hornef  s  longitudinal  axis  control 

architecture. 


As  seen  by  the  location  of  the  Angle  of  Attack  feedback,  it  becomes  patentiy 
obvious  that  this  is  a  major  input  to  the  longitudinal  axis,  pitch  control  and  stabilator 
commanded  position. 


computers 
respect  to 


Although  the  AOA  probes  have  quadruplex  interfaces  with  the  flight  control 
wo  position  transducers  per  probe),  the  probes  are  only  dual  redundant  with 
schanical  failures  like  a  jammed  probe. 


In  cases  where  the  dnal  redundant  Angle  of  Attack  Probes  have  a  single  AOA 
Probe  failed  at  an  extreme  of  its  travel,  an  unrecoverable  pitch  transient  results  under  prior 
flight  control  software  architecture. 


Last  year  we  unfortunately  lost  an  F/A-18  and  young  Naval  Aviator  off  a 
catapult  launch  from  a  carrier,  at  sea  due  to  such  a  failure. 


Hornet  Flight  Control  System 

♦  Lateral-Directional  Outer  Loop  Feedback: 
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In  this  simplified  control  law  architecture  diagram  of  the  lateral-directional 
axis,  things  are  more  difficult  to  break  out  and  see  the  effects  of 


First,  as  with  most  aircraft,  lowering  the  landing  gear,  and  flaps  has  a  net 
destabilizing  effect  on  the  aircraft’s  directional  stability.  The  directional  stability  margin  in 
the  all  configurations  and  phases  of  flight  is  normally  more  than  adequate.  In  the  takeoff  an 

landing  phases,  angle-of-attack  is  limited  to  15  degrees  or  less  by  the  flight  manual. 


Above  this  value,  the  directional  stability  decreases  rapidly,  and  the  dihedral 
effect  remains  strong,  so  that  any  sideslip  results  in  a  significant  rolling  moment  that  can 
rapidly  exceed  the  remaining  roll  control  power. 

In  situations  where  the  rudder  has  failed  during  the  takeoff  and  landing  phases, 
aircrew  have  sometimes  unfortunately  allowed  angle  of  attack  to  increase  while  attempting  to 
reduce  the  induced  roll  due  to  sideslip.  When  a  rudder  fails  under  prior  Hornet  flight  control 
laws,  any  toe-in  or  out  on  the  “good”  rudder  is  removed  at  a  rapid  rate,  and  then  follows 
normal  rudder  commands.  In  the  takeojf  and  landing  phases,  the  rate  of  removal  of  rudder 
toe-in  on  the  “good”  rudder  was  much  faster  than  the  blow-back  rate  of  the  failed  rudder. 

With  half  of  the  normal  rudder  control  power  removed,  and  angle  of  attack  and 
sideslip  angle  increasing,  a  departure  follows  quickly. 


Hornet  Mishap  Simulation  Video 

♦  Video  from  simulation: 

-  F/A-18C 

-  2  Wingtanks,  4Mk-83’s,2CATM-7’s, 

2  CATM-9’s  &  578  Rounds  of  20mm 

-  49,000  lb.  Gross  Weight  Aircraft 

-  One  Angle  of  Attack  Probe  failed  at  54  degrees 
—  Steam  Catapult  #2,  “generic”  Aircraft  Carrier 
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The  following  video  is  from  simulation  conducted  at  the  Manned  Flight 
Simulator  facility  at  the  Naval  Aircraft  Weapons  Center,  Aircraft  Division,  Patuxent  River. 


The  aircraft  simulated  was  a  F/A-18C,  with  two  wing  tanks,  four  Mark-83 
1  000  lb  bombs,  two  captive  carry  Aim-7  Sparrows  and  two  captive  carry  Aim-9  Sidewinder 
missiles.  In  the  video,  the  aircraft  you  will  see  will  visually  lack  this  configuration  due  to 
limitations  of  the  visual  presentation.  However,  the  simulator  accurately  models  the 
incremental  store  weights,  contributions  to  center  of  gravity  and  effects  on  aircraft 
performance  and  handling  qualities. 


During  the  catapult  stroke  the  left  angle  of  attack  probe  fails  at  the  extreme 
positive  value.  This  occurs  prior  to  AOA  feedback,  and  the  flight  controls  system,  once 
airborne  recognizes  the  mismatch  in  AOA  and  uses  the  “last  best  known  value”  assumed  to  be 
from  prior  to  weight  off  wheels.  The  tragic  fault  in  this  basic  assumption  is  that  the  AOA 
probe  has  failed  prior  to  weight  off  wheels. 


For  most  instances  of  this  failure,  the  resulting  pitch  transient  is  unrecoverable. 


Hornet  Mishap  Simulation  Video 

♦  Video  from  simulation: 

-F/A-18C 

—  Centerline  fuel  tank,  2  Mk-83’s  on  the  Right 
Wing,  2  CATM  -7’s,  2  CATM-9’s 

&  578  Rounds  of  20inm 
_  44,000  lb.  Gross  Weight  Aircraft 

-  Left  Rudder  Actuator  Fails  during  Catapult 

-  Steam  Catapult  #2,  “generic”  Aircraft  Carrier 


Again  this  simulation  was  conducted  at  Pax  River. 


The  external  stores  load-out  has  been  changed.  This  configuration  was 
selected  due  to  actual  incidents,  and  because  it  exacerbates  this  particular  failure. 


During  the  catapult  stroke  the  left  rudder  fails  starting  its  toed  in  position  of  30 
A  Tn  the  Hornet  the  rudders  are  “toed-in”  during  takeoffs  to  optimize  pitch  rate  an 

angle  of  attack  capture.  The  failure  of  a  rudder  actuator 
vlifTht  is  off  the  main  wheels,  the  toe-in  command  is  removed  (due  to  the  failure),  which 
resuKs  in  poorer  rotation,  and  asymmetric  rudder  position  as  toe-in  on  the  remammg  goo 

rudder  is  removed. 


The  resulting  yaw  and  roll  due  to  the  failed  rudder  position  is  controllable. 


Flight  Controls  System  Update 

♦  Initiated  as  a  “Must  fix  now”  priority 

♦  Common  Flight  Controls  System  software 
for  all  Hornets, 

-  F/A-18A-D,  US  and  Foreign  Military  Sales 
»  Less  Risk 


»  Fewer  Costs 


» Improves  Safety 


♦  “Low  Budget,  Minimum  Risk,. ..no  changes 
to  basic  aircraft  modes  or  flying  qualities.” 
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Unfortunately,  the  flight  controls  system,  its  hardware  and  software 
architecture  do  not  undergo  scheduled  continual  refutement  or 

life  of  the  airframe  Typically  many  flight  controls  system  improvements,  both  performance 
jer.Sarcan'b^  low^enou^h  priority  to  not  be  implemented  until  such  ttme  as  they 

rise  markedly  in  the  priority  rankings. 


In  response  to  significant  safety  issues,  it  is  possible  to  update  the  flight 
controls.  The  preferable  methodology  would  be  to  entertain  these  improvements  ^d 
incorporate  “bL”  or  flight  test  versions  only  that  can  undergo  planned  improvement,  and 

evaluation. 


In  light  of  the  real  world  constraints  of  finite  budgets,  and  multiple  priorities 
we  are  thankful  for  this  recent  series  of  flight  controls  system  upgrades.  The  basic  gamephm 
going  into  this  evolution  was  to  incorporate  only  those  required  safety  improvements,  while 

minimizing  costs_  and  risks. 

The  requirements  were  successful  implementation  of  the  safety  improvements, 
with  no  impact  to  normal,  or  current  operating  modes,  flying  qualities  or  performance. 


GROUND  TESTING 


♦  Simulator  Preparation  -  Implementing  the 
PCS  Software  Change 

-  FORTRAN:  Small  Stuff  Counts  -  BIG! 

»  Coding  From  The  Proper  System  Documentation 
»  Human  error  in  resulted  in  the  Simulator  being  not 
representative  of  the  real  Aircraft/Flight  Control 
system,  e.g.  no  ramp  in  gain  changes  or  alpha  or 
beta  values 

♦  Regression  Testing 
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Prior  to  receiving  the  actual  upgrade  to  the  flight  controls  software  we  had 
received  substantial  documentation  of  the  changes,  decision  matrices  and  code. 

To  minimize  the  fleet’s  exposure  to  operational  risks  that  this  upgrade  was  to 
fix,  we  began  to  write  a  ground  test  ^‘quick-loo^  copy  of  the  new  software  load.  This  was 
done  in  FORTRAN,  by  following  the  system  descriptions  and  documentation. 

One  area  of  difficulty  was  in  learning  and  writing  into  the  code  all  the  changes 
that  would  be  present  in  the  new  software.  As  we  found  out,  some  of  the  system  descriptions 
and  flow  charts  were  simplified  or  abbreviated  versions.  Of  course,  this  meant  that  our  early 
bird  efforts  were  meant  well,  but  improperly  done.  Accordingly  many  man-hours  were  lost. 

A  classic  case  of  engineers  and  technicians  working  closely  with  aircraft  and 
systems,  but  missing  a  basic  detail  also  ensued.  After  the  correct  hardware  and  contract 
supplied  software  was  incorporated  in  lab,  during  regression  and  simulator  testing  we 
uncovered  another  gotcha’.  Certain  failure  modes,  and  flight  operations  involved  v^ues  of 
angle  of  attack  and  beta  that  changed  with  time.  Unfortunately,  this  was  overlooked,  and  step 
changes  in  AOA  and  Beta  were  written  into  the  simulator  operating  software  which 
accordingly  resulted  in  flying  qualities  anomalies,  or  anomalies  that  were  significantly 
magnified  by  this  mistake.  In  due  course  these  errors  were  also  found  and  corrected.  This 
highlights  the  requirement  for  close  aircrew/engineer  interaction  and  exchange  of  information, 
during  testing,  and  also  applies  during  requirements  development. 

Additionally  regression  testing  was  satisfactorily  conducted  to  evaluate 
reversionary  modes  and  logic  that  could  not  be  flight  tested. 


GROUND  TESTING _ 

♦  Hardware  in  The  Loop  Simulation 

is  VITAL. 

♦  Piloted  Simulation 

-  “No  changes  to  basic  a/c  modes  or  flying 
qualities.” 

-  “Spot  Check”  mentality  vs.  BIG  PICTURE 

-  Scenarios  must  be  to  a  logical  conclusion 
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From  the  ground  based  testing  we  had  come  to  a  significant  conclusion  upon 
which  we  based  all  subsequent  ground  testing.  That  hardware  in  the  loop  and  actual  software 
were  RF.OUTRED  to  conduct  the  actual  tests. 

For  the  piloted  simulation,  a  wide  variety  of  Navy  and  Marine  pilots  were  used. 
Numerous  simulations  were  conducted  using  different  scenarios.  Also  pilot  types  were  varied 
from  low  gain  to  high  gain  and  then  to  worst  case  -  or  aggravated  inputs. 

Based  on  the  briefed  premise  and  objective  of  “no  changes  to  basic  aircraft  flying 
qualities  or  modes”  and  urge  to  complete  testing  and  get  the  Ufe  saving  improvements  to  the 
fleet;  we  were  not  expecting  anything  untold  or  abnormal.  Also,  prior  flight  controls  software 
upgrades  had  been  a  ho-hum  evolution.  Accordingly,  some  individuals  approached  this  testing 

with  a  spot  check  only  mentality. 

This  soon  proved  an  unwise  outlook  as  we  uncovered  severe  anomalies  in  the  dual 
probe  angle  of  attack  logic.  This  was  a  well  meant  no-cost  attempt  by  contractor  to  provide  fail- 
Lfe  operation  for  a  dual  AOA  probe  failure.  The  software  changes  for  dual  AOA  probe  failures 
would  be  life  saving,  if  off  the  catapult  the  flaps  were  raised  during  the  ten  seconds  the  software 
provided  fixed  AOA  gains  to  the  flight  control  computers.  After  that  the  software  revert^  to  t  e 
erroneous  last  best  known  value  and  unrecoverable  nose-down  pitch  transients  resulted.  Tlus 
proved  to  be  a  futile  effort  to  correct  for  a  statistically  extremely  unlikely  dual  AOA  probe  fai  ure. 
Also  this  again  highlighted  the  shortcomings  of  an  electrically  quad  redundant  flight  contro  s 
system,  that  has  duplex  AOA  hardware,  when  triplex  or  quad  redundant  would  be  more 
appropriate  given  the  longitudinal  axis  dependency  of  AOA  feedback. 

For  the  single  AOA  probe  failures,  for  certain  values  of  AOA  failure  severe  pitch 
transients  would  occur  as  the  software  cycled  through  logic  and  in  and  out  of  fixed  AOA  values. 
This  was  not  evident  until  we  insisted  that  the  inserted  failures  be  flown  to  a  safe  recovery,  field 

or  carrier. 


GROUND  TESTING 


♦  Piloted  Simulation  (continued) 

-  Good  data  quantity,  poor  coverage  of  envelope 
-  takeoff  and  landing  phases. 

-  Programmatics  must  not  interfere  with  solid 
test  &  evaluation  -  from  within  the  test  team  or 
without! 

-  Do  Deficiencies  Exist? 

Then  state  it! 
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A  significant  learning  point  was  to  ensure  that  not  just  were  carrier  evolutions 
or  failures  simulated.  Granted  that  carrier  operations  pose  unique  performance  demands 
upon  the  pilot  and  aircraft  and  are  even  more  unforgiving  than  land  based  operations. 

The  Hornet  is  flown  differently  by  units  within  the  Navy  and  Marine  Corps, 
and  then  again  by  other  nations  flying  this  great  aircraft.  The  scope  of  the  simulation  was 
expanded  to  include  all  flight  manual  approved  takeoff  and  landing  techniques,  with  normal, 
low,  high  gain  and  aggravated  inputs.  Additionally  the  Navy  Flight  Demonstration  Squadron 
the  mue  Angles  operate  uniquely,  executing  filed  takeoffs  with  only  flaps  retracted  and  no 
stabilator  trim.  Finally  we  had  to  fly  the  extremes  of  the  envelope  with  respect  to  gross 
weights,  cg’s,  and  lateral  asymmetries  for  all  types  of  takeoffs  and  recoveries. 

The  deficiencies  that  were  stated  before  regarding  the  dual  AOA  probe  failure 
detection  logic  and  cycling  pitch  transients  due  to  software  were  downplayed  by  some.  The 
belief  was  that  these  deficiencies  were  acceptable  in  light  of  the  overall  improvements 
resident  in  the  system  upgrade,  and  that  we  did  not  want  to  “kill”  the  program.  We  had  a  time 
reminding  a  few  test  team  members  that  as  testers  we  do  not  kill  anything,  but  merely  report 
our  findings  and  conclusion  and  recommendations. 

In  the  end  of  this  ground  phase,  the  systems  shortcomings  were  appropriately 
documented  and  we  proceeded  to  flight  test. 


Flight  Testing 

♦  Normal  modes  of  operation  and  Mission 
Tasks  are  primarily  evaluated  by  qualitative 
pilot  comments  and  evaluation. 

(CH  HQR  &  PIO  Scale) 

♦  Envelope  Verification 

-  Classic  FQ&P,  Pilot  Relief  Modes,  Mission 
Tasks 

♦  Inflight  Simulation  of  Failures  -  PSFCC’s 
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For  the  flight  test  portion,  the  normal  flight  controls  operation  was  documented 
by  standard  performance  and  flying  qualities  testing. 

Qualitative  pilot  comments  on  handling  qualities  were  vitally  important, 
especially  during  the  mission  tasks  portion  of  the  testing.  Such  testing  is  highly  subjective 
and  requires,  as  always  careful  planning  and  the  designing  of  appropriate  tasks,  with 
corresponding  adequate  and  desired  criteria. 

Currently  the  Navy  and  NASA  are  preparing  to  flight  test  Production  Support 
Flight  Control  Computers,  or  PSFCC’s  that  present  the  opportunity  and  ability  to  safely  insert 
and  flight  test  the  type  of  failures  and  failure  protection  logic  we  are  currently  only  able  to 
ground  test  and  simulate.  Furthermore,  these  Production  Support  Flight  Control  Computers 
also  have  the  growth  potential  for  aiding  accident  investigations  by  safely  inserting  and  flying 
failures  that  are  encountered  during  Hornet  operations.  One  of  our  recommendations  is  the 
continued  development  of  these  PSFCC’s  towards  that  end. 


“It  is  ONLY  software,,,” 


♦  Or,  “The  evil  sneak  circuit.” 

-  Importance  of  Qualitative  Pilot  Comments 

-  Importance  of  timely  data  analysis 

-  Results  of  Improperly  Sensed  Dual  AOA  Probe 
Failure: 

»  FCS  AOA  goes  to  zero 
»  Left  &  Right  LEF  Deflections  go  to  zero 
»  Rudders  toe  in 

-  Uncommanded  pitch-up  after  weight  on  wheels 
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During  the  course  of  the  flight  testing  two  project  pilots  said  that  the  aircraft 
felt  “funny”  during  flared  field  landings  that  were  conducted  for  fuel  weight,  and  not  as 
dedicated  test  points.  The  perceived  anomalies  were  debriefed,  and  the  contractor  was  asked 
to  review  and  analyze  the  data. 

Unfortunately  neither  pilot  had  conducted  many  flared  landings  in  the  Hornet, 
and  were  unfamiliar  with  the  flared  landing  handling  qualities.  However,  both  pilots  were 
correct  in  that  the  aircraft  was  not  behaving  normally.  And  both  pilots  commented  on  how 
the  aircraft  felt  as  though  it  was  pitching  up  during  the  flared  landing,  and  that  positive 
forward  stick  inputs  were  required  to  arrest  the  pitch  rate,  and  then  also  to  start  the  nose  to 
come  back  down. 

Due  to  other  projects  and  conflicting  priorities  the  contractor  engineer  did  not 
analyze  the  data  until  much  later.  Then  he  reported  that  there  was  a  longitudinal  pitch-up 
occurring  due  to  the  flared  landings.  The  flared  landing  had  both  touched  down  above  10 
degrees  AOA,  all  normal  landings  are  conducted  at  8.1  degrees  AOA,  with  certain  emergency 
procedures  calling  for  landings  above  10  degrees  AOA. 

The  dual  AOA  probe  failure  logic  was  being  erroneously  triggered  by  touching 
down  above  10  degrees  AOA.  This  10  degrees  AOA  at  weight  on  wheels  then  via  the  revised 
logic  toed  the  rudders  in  by  30  degrees  and  drove  the  leading  edge  flaps  from  17  degrees  of 
droop  to  0  degrees.  These  then  were  causing  the  significant  pitch-up  at  weight  on  wheels. 


Improperly  Sensed 

Dual  AOA  Probe  Failure 

♦  Further  analysis 

-  Trailing  Edge  Flaps  Off  Emergency  Procedures 

-  Lateral  Asymmetries 

—  Cross  Winds  and  Gusts 

♦  Current  Flight  Manual  Limits 

—  Not  Achievable  for  these  items 

04/16/96 

16 

Further  analysis  of  the  flight  manual  procedures  for  trailing  edge  flap  failures 
such  as  a  trailing  edge  flap  actuator  failed  would  result  in  the  trailing  edge  flaps  being 
inoperative  or  “off.”  For  such  failures  the  flight  manual  procedures  direct  the  approach  and 
landing  be  conducted  at  10-11  degrees  AOA  to  reduce  the  approach  speed.  Thereby 
triggering  the  dual  AOA  probe  failure  logic  at  weight  on  wheels. 

Further  simulation  conducted  with  trailing  edge  flap  failures,  and  any  landings 
with  HUD  AOA  above  10  degrees,  especially  with  lateral  asymmetries,  cross  winds  and  gusts 
revealed  that  departure  and  roll  over  during  landing  roll  out  could  result.  The  test  team  cited 
these  deficiencies  as  unsatisfactory  and  recommended  that  they  be  correct  prior  to  further 
flight  test. 

Accordingly,  representatives  from  the  Pax  River  test  team  met  with  and  briefed 
the  Program  Manager  and  his  team  at  NAVAIR. 

Prior  to  the  briefing  to  the  Hornet  Program  Manager,  key  meetings  were 
conducted  by  the  program  personnel,  the  testers  and  the  contractors.  It  was  during  this  unique 
give  and  take,  exchange  of  information  and  ideas  and  brainstorming  that  an  effective 
gameplan  was  quickly  drafted.  The  resulting  options  were  drafted  and  presented  to  the 
Hornet  Program  Manager  in  ranked  order. 


The  agreed  upon  solution  was  to  “no-op”  the  offending  dual  AOA  probe  logic 
and  there-by  remove  the  unsafe  pitch-up  on  landing. 

The  no-op  was  accomplished  by  the  elegant  and  effective  cutting  off  of  the 
transmission  of  the  “dual  AOA  probe  failure  detected”  signal  from  the  rest  of  the  software, 
flight  control  system  and  aircraft.  In  this  fashion,  minimal  changes  were  required  in  the  flight 
controls  software,  and  risk  was  kept  to  a  minimum. 

However,  we  were  not  out  of  the  woods  yet.  A  long  standing  recommendation 
to  incorporate  the  take-off  trim  setting  of  12  degrees  trailing  edge  up  on  the  stabilators  was 
evaluated  as  a  low  risk  addition,  that  was  cheaply  incorporated.  We  the  testers  had  a  feeling 
the  check  was  in  the  mail! 

Once  again  the  assumption  that  it  was  only  software  was  upon  us.  We  felt  that 
we  knew  now  that  any  software  changes  to  the  flight  controls  could  have  effects  not 
anticipated  during  the  decision  making  or  planning  stages. 


The  no-oping  of  the  dual  AOA  probe  failure  detection  logic  resulted  in  a  good, 
safe  upgrade  to  the  flight  controls  system  for  the  F/A-18  Hornet.  Gone  were  the  pitch-up  on 
landing,  and  false  triggering  of  the  logic  for  aggressive  takeoffs. 

The  twelve  degrees  takeoff  trim  change  resulted  in  a  certain  amount  of  work 
and  heartache  from  the  required  revisions  to  the  flight  manual  and  procedures.  The  good 
news  was  that  the  change  in  takeoff  trim  setting  mechanization  resulted  in  no  other 
repercussions  or  sneak  circuit  manifestations. 

Lastly,  a  quick  video  demonstrating  the  effectiveness  of  these  simple  changes. 


Conclusions  & 
Recommendations 


♦  Final  Flight  Controls  System  Software 
VIO.5.1  is  SATISFACTORY. 

♦  Fleet  Release  of  VIO.5.1  is  Pending 
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Read  slide. 


Lessons  Learned 


♦  Don’t  Attempt  to  Squeeze  Fail-Operate 
Performance  from  a  Dual  Redundant 
System  (AOA  Probes) 

♦  Perform  Risk-Benefit  Analysis  Prior  to 
Implementing  “Low  Risk,  Low  Cost  Fixes” 
(Dual  AOA  Probe  Failure) 

♦  Adequate  Envelope/Scenario  Coverage 
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Read  slide. 


Lessons  Learned  (continued) 

♦  Dedicated  Manpower  Support  /  Priority 

♦  Recommend  Continued  Development  of  the 
PSFCC’s  to  Conduct  Inflight  Simulation 

-  Pitch  Oscillations,  Visual,  Nz  &  Ny  effects 

-  Inflight  Simulation  Yields  Results  that  are 
closer  to  the  real  failure  or  degrade  and 
physically  not  available  in  fixed  base 
simulation. 

♦  Input  for  Flight  Manual  (NATOPS)  Update 
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Read  slide. 


